Personvernnemnda (Norway) - 2020-14 (19/00110)

Datatilsynet - 19/00110
Authority:	Datatilsynet (Norway)
Jurisdiction:	Norway
Relevant Law:	Article 6(1)(f) GDPR Article 17 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	10.11.2020
Published:
Fine:	None
Parties:	Google
National Case Number/Name:	19/00110
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Norwegian
Original Source:	Personvernrådet (in NO)
Initial Contributor:	n/a

The Norwegian Privacy Appeals Board (Personvernrådet) unanimously overturned the Norwegian DPA's (Datatilsynet) decision to maintain Google search results following an Article 17 erasure request.

English Summary

Facts

An online newspaper article from 2012 mentioned the complainant's resignation as the head of an educational institution. The article states that the complainant resigned after three months, after the employees sent a letter to the board demanding the resignation of the manager. According to the article, the employees felt that the data subject did not have the right background for the position.

The then chairman of the board and acting director confirms in the article that they received such a letter, but does not comment on its content or the relationship in general. It appears from the article that the online newspaper has tried to contact A several times, but that they have not succeeded in getting a comment from her. When the educational institution went bankrupt in the spring of 2014, a different party bought the bankruptcy estate and continued the operation of the educational institution in a new company.

In 2017, the data subject asked Google to delete the search term for her name which led to the newspaper article in question. One year later, Google informed the complainant that it refuses to delete the search result. Despite appeals from the complainant, Google continued to refuse moving forward with the erasure request.

The complainant also contacted the editor of the online newspaper online newspaper and the media company Amedia, which owns the newspaper, and requested that the article be deleted. The editor rejected the delete request, referring to the fact that the newspaper does not in principle delete articles from its website. Amedia stated that they do not interfere with the newspaper's editorial content.

Consequently. the data subject complained to the Datatilsynet and requested assistance in having the search result deleted by searching for her name in Google. The DPA made a balance of interests between the consideration of freedom of information and the public's interest in having access to the search match by name search and the complainant's right to protest that the search match is displayed, and rejected her request for deletion.

When conducting the balancing exercise, the DPA pointed out that it is almost seven years since the article in question was published, and that the information is gradually losing its relevance. Although six to seven years in isolation is not a long time, the Data Inspectorate believes that the time aspect, seen in light of the fact that the company no longer exists, speaks in favor of deindexing. In this context, the complainant stated that she experiences a negative impact as job recruiters overlook the age of the article.

The personal information was published in connection with the complainant resigning from his position as head of a company and, in the DPA's assessment, it will often be in the public interest to know a company's managers, form of board and changes at management level. As a manager, you must basically assume that your name is used in contexts where the company is mentioned. This speaks against the DPA's assessment against deindexation. The Datatilsynet has placed particular emphasis on the fact that only information about the complainant by virtue of her professional position has been published. Furthermore, the DPA points out that the personal information was originally published by a newspaper while the case was relevant and had news value. The fact that the information appears in a journalistic context is a factor that the DPA believes speaks against de-indexing.

Dispute

Was the DPA's assessment correct, or should Google be ordered to delete the relevant search match?

Holding

First of all, the PVN drew attention on the DPA's use of the term 'de-indexing'. The PVN argued that a better choice of words would be deletion of search results, since the information will still be indexed by Google and will be available by name search in Google's search interface if this is done, for example, from a non-European IP address.

The PVN further criticised the DPA's handling of the case, deeming it easy and unprofessional, and stating that the Datatilsynet did not dare to take the necessary steps towards Google. In balancing the relevant interests, the PVN acknowledged that the initial publication for journalistic purposes was indeed of public interest at the time. However, the Personvernrådet emphasised that this public interest weakens with time, especially after eight years have already passed. Furthermore, the PVN noted that the newspaper article to which the search meeting leads provides very limited information about the reason why the data subject resigned, in addition to a letter from the employees being sent to the board demanding their resignation. Furthermore, the article about the change of leadership is easily accessible on the website of the online newspaper, which is the local newspaper where the educational institution is located. Anyone who is interested in finding older news articles about the educational institution will therefore easily find these by searching the website of the online newspaper.

The PVN also referred to the Google Spain ruling and reiterated that the right to be forgotten is not conditional on the relevant personal data having entailed negative consequences ("damages") for the data subject. If there are sufficient grounds for such consequences, there will, however, be a factor that leads in the direction of the data subject being granted the claim for deletion. In this context, the PVN also emphasised the negative career consequences of the complainant, who suffered in recruiting processes because of the Google search results.

The PVN therefore unanimously decided that the complainant's interest in having the search match deleted outweighs the consideration of freedom of information and the public's interest in having access to the search match by name. Google was consequently ordered to delete the search results when searching with the data subject's name. The information will still be available from search engines, but then keywords other than personal names must be used, such as the subject matter of the case, or it must be searched via a non-European IP address.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Norwegian original. Please refer to the Norwegian original for more details.

PVN-2020-14 Deleting search results in the Google search engine
The Data Inspectorate's reference: 
19 / 00110-7 / TSM
Decision of the Privacy Board 10 November 2020 (Mari Bø Haugstad, Bjørnar Borvik, Gisle Hannemyr, Line Coll, Hans Marius Graasvold, Ellen Økland Blinkenberg, Hans Marius Tessem)
The case concerns an appeal from A on the Data Inspectorate's decision of 5 July 2019 rejecting a claim for deletion of search results in the search engine Google.

Background to the case
The case has its background in a newspaper article published in an online newspaper in the autumn of 2012 which mentions A's resignation as head of an educational institution. The article, entitled "[…]", states that A resigned after three months after the employees sent a letter to the board demanding the resignation of the manager. According to the article, the employees felt that A did not have the right background for the position. The then chairman of the board and acting director confirms in the article that they received such a letter, but does not comment on its content or the relationship in general. It appears from the article that the online newspaper has tried to contact A several times, but that they have not succeeded in getting a comment from her.

When the educational institution went bankrupt in the spring of 2014, B bought the bankruptcy estate and continued the operation of the educational institution in a new company.

A contacted Google on 14 September 2017 and requested that the search term for her name be deleted in Google, which led to the newspaper article in question, […]. In an email to A on September 18, 2018, Google refused to delete the search result.

A appealed the decision on 17 October 2017 and 22 December 2018, but Google upheld the refusal in emails to A on 18 October 2017 and 24 December 2018.

A also contacted the editor of the online newspaper online newspaper and the media company Amedia, which owns the newspaper, and requested that the article be deleted. The editor rejected the delete request, referring to the fact that the newspaper does not in principle delete articles from its website. Amedia stated that they do not interfere with the newspaper's editorial content.

A brought Google's refusal to the Data Inspectorate on 31 December 2018 and requested assistance in having the search result deleted by searching for her name in Google. The Data Inspectorate made a balance of interests between the consideration of freedom of information and the public's interest in having access to the search match by name search and A's right to protest that the search match is displayed, and rejected her request for deletion in a decision on 5 July 2019.

A submitted a timely appeal against the Data Inspectorate's decision of 14 July 2019.

The Data Inspectorate assessed the complaint, but found no reason to change its decision. The case was sent to the Privacy Board on 27 August 2020. The parties were informed of the case in a letter from the board on 28 August 2020, and were given the opportunity to comment. Neither party has commented.

The case was discussed at the tribunal's meeting on 10 November 2020. The Privacy Board had the following composition: Mari Bø Haugstad (chair), Bjørnar Borvik (deputy chair), Gisle Hannemyr, Line Coll, Hans Marius Graasvold, Ellen Økland Blinkenberg and Hans Marius Tessem. Secretariat leader Anette Klem Funderud was also present.

The Data Inspectorate's assessment in outline
The Data Inspectorate initially states in the decision that the audit is the right supervisory authority and has competence to process the case, and that the Personal Data Act § 3 does not apply to cases concerning the deletion of search results.

The Data Inspectorate then explains the legal starting points in the case and refers to the Privacy Ordinance Article 6 No. 1 letter f as the relevant valid basis for processing, as well as Article 21 No. 1 on the data subject's right to protest. Furthermore, reference is made to the former Article 29 group's (the forerunner of the Privacy Council under the Privacy Ordinance) prepared guidelines for how privacy and freedom of information should be weighed in cases concerning deletion of search hits, which are still considered relevant even after the entry into force of the Privacy Ordinance.

For its assessment of the case, the audit is based on the fact that the search engine, according to Article 21, can only continue the processing if there is a public interest in having access to the personal data. In addition, the public interest must constitute compelling justifiable reasons for the processing that takes precedence over the data subject's interest.

The audit points out that it is almost seven years since the article in question was published, and that the information is gradually losing its relevance. Although six to seven years in isolation is not a long time, the Data Inspectorate believes that the time aspect, seen in light of the fact that the company no longer exists, speaks in favor of deindexing.

The personal information was published in connection with A resigning from his position as head of a company and, in the Data Inspectorate's assessment, it will often be in the public interest to know a company's managers, form of board and changes at management level. As a manager, you must basically assume that your name is used in contexts where the company is mentioned. This speaks against the Data Inspectorate's assessment against deindexation. The Authority has placed particular emphasis on the fact that only information about A by virtue of her professional position has been published.

The Data Inspectorate has also assessed the consequences the search result is considered to have for A. It is stated that A states that she has no problem standing in cases concerning her person, but that rogue recruitment methods mean that coincidences affect selections as the age of the article is overlooked. The Norwegian Data Protection Authority points out that this can have a negative impact on A, even though the consequences are difficult to measure.

The Data Inspectorate further points out that the personal information was originally published by a newspaper while the case was relevant and had news value. The fact that the information appears in a journalistic context is a factor that the Data Inspectorate believes speaks against de-indexing.

After a specific balancing of interests, the Data Inspectorate came to the conclusion that A's protest against the search results being displayed by name search cannot be accepted. The freedom of information and the public's interest in having access to the search match by name search constitute in this case compelling justified reasons that precede her protest, cf. the Privacy Ordinance Article 21 no. 1, cf. the Personal Data Act § 1.

A view of the case in outline
The Google search hit that leads to the newspaper article in an online newspaper from August 17, 2012 must be deleted because:

1. The article is eight years old and no longer has relevance or public interest.

2. The burden on her is unfair.

3. The educational institution referred to in the article does not exist today.

4. Privacy is stronger than before, and the right to be forgotten is real.

5. She is not to be regarded as a public figure who is constantly mentioned.

Rogue recruitment methods mean that coincidences affect selections as the age of the article is overlooked.

7. Google does not respond with responses that absorb the information sent to them, but sends an illegal robot response that involves ignoring and disclaiming responsibility for both the Data Inspectorate's and Google's own guidelines. Google therefore does not make any assessment of common sense.

8. The newspaper in question does not respond to the delete request sent to them.

The Data Inspectorate's handling of the case is easy and unprofessional. The Authority does not dare to take the necessary steps towards Google. The audit should conduct investigations related to the company's management outlines. She received a mouthful in connection with her resignation and the article that the search results lead to does not show the whole. After all these years, the article is no longer relevant anyway. The Authority is unable to distinguish between what is no longer relevant and not in its assessment of "compelling justifiable reasons".

The Norwegian Data Protection Authority has, through its time use and case processing, contributed to an additional and unnecessary burden for her.

Google's views on the matter
Google has not issued a statement in the case, neither for the Data Inspectorate nor the Privacy Board. Below is the answer Google gave A when she contacted them with a request to delete search results:

"In this case, it seems that the URL relates to your professional career, and therefore it is in the public interest. For example, the content of the URL may be of interest to current and potential future customers or users of your services. Information about recent businesses may be of interest to potential or current customers or users of your services. We are therefore unable to remove this document from our search results, because your name is in the public interest.

We at Google have currently decided not to take action against these URLs.

However, you can send your removal request directly to the webmaster who controls the site in question. The web editor has the ability to remove the relevant content from the web or block it from appearing in the search engines. If you're wondering how to contact the webmaster of a site, visit https: //support.google.comlwebsearch/answer/9109 .

If obsolete content from a site appears in Google's search results, you can ask Google to update or remove that page. If so, use our site removal tool, located at http://www.google.com/webmastersltools/removals .

You may also have the right to take up the matter with the data protection authorities of your country, if you are not satisfied with the decision made by Google. If you choose to contact them, you may want to provide the reference number 8-3457000019013 and a copy of the confirmation of submission of the form for this request to Google. If Google acts as the webmaster of the site in question, try contacting the owner or author of the page to ask them to remove the content. "

The Privacy Board's assessment
The Privacy Board will decide whether Google should be ordered to delete the relevant search match in A's name that leads to the newspaper article from 2012 where her resignation from the position as head of an educational institution is mentioned.

In its decision, the Data Inspectorate has used the term deindexation. In the tribunal's assessment, it is more correct to refer to this as deleting search results. The information will still be indexed by Google and will be available by name search in Google's search interface if this is done, for example, from a non-European IP address, cf. the corresponding assessment in PVN-2020-08.

The legal basis for the assessment
There is no doubt that what happens when a search engine collects personal data and presents search results to the public, represents a processing of personal data and is regulated by the Privacy Ordinance, cf. Article 4 no. 2. The search engine provider is responsible for the processing of personal data this connection, cf. Article 4 no. 7. This is also based on the European Court of Justice, both in judgment C-131/12 of 13 May 2014 ( Google Spain and Google) and in judgment C-136/17 of September 24, 2019 ( GC & Others v CNIL ). This is also in line with established administrative practice from the Norwegian Data Protection Authority and the Privacy Board, see for example PVN-2020-08 and PVN-2019-02.

Although the above-mentioned judgments of the European Court of Justice directly clarify the understanding of the EU Personal Data Directive (Directive 95/46), the judgments are also relevant for the interpretation of the Privacy Regulation. This is because the provisions in the regulation on what constitutes the processing of personal data and who is to be regarded as the data controller is a continuation of the provisions in the directive.

Like the Norwegian Data Protection Authority, the tribunal assumes that it is the Privacy Ordinance, Article 6, No. 1, letter f, which in principle provides Google with a processing basis for collecting personal data and presenting search results to the public.

As A has protested against the processing of personal data, cf. Article 21 (1) of the Privacy Ordinance, it follows from Article 17 (1) (c) that Google has a duty to delete the data (ie remove the search hit) unless it is more weighty. justified reasons for the processing that take precedence over the data subject's interests, rights and freedoms. In other words, a balance of interests must be struck between the data subject's interest in having the search match deleted, against the public's interest in gaining easy access to this information via a search engine. In this connection, the tribunal would like to point out that deleting search results from a search engine is not about removing the information from the Internet as such. All information will still be available on the original websites, such as the websites of newspapers and other mass media, and on these sites the information will still also appear by name search. Furthermore, the information will be available from search engines, but then keywords other than personal names must be used, such as the subject matter of the case, or it must be searched via a non-European IP address.

The European Court of Justice has ruled in Google Spain and Google that there is a presumption in the balance of interests that the registered person has the right to have the search hit deleted, unless special considerations apply. In the opinion of the Privacy Board, Google's response to A's deletion claim is not in line with this legal starting point. There is no evidence that the rejection of the deletion claim is based on a real balance of interests:

«[…]

We at Google have currently decided not to take action against these URLs.

However, you can send your removal request directly to the webmaster who controls the site in question. […] »

As this is a published article in an online newspaper, the processing of personal data that takes place there will be covered by the exception in the Personal Data Act § 3, and the data subject will thus have no requirement to have the information deleted by the web editor. It is Google, as the controller, who, under Article 21 (1), must demonstrate that there are compelling justifiable reasons for the processing which take precedence over the interests of the data subject and which are thus also required to carry out this balancing of interests in the first instance when they receive a request for deletion. .

In Google Spain and Google , the European Court of Justice points out that the search engine provider's processing of personal data differs from, and represents something in addition to, the processing done by the publisher of websites (section 35). This means that the outcome of the balance of interests that the directive provides guidance on may be different for the search engine provider than for the publisher of the Internet pages. This may be partly due to the fact that the interests that justify the processing of personal data may be different, and partly it may be due to the fact that the consequences of data processing will be different. The European Court of Justice struck in Google Spain and Googleprovided that the provider of search engine services may have a duty to delete a search match at the request of the search match to which it applies, even if the publisher of the website has a processing basis for publishing the information on its website (section 88). This position is continued in GC & Others v CNIL (section 52).

Regarding the specific balancing of interests, the European Court of Justice says in Google Spain and Google , section 81:

'Although the rights of the data subject protected by these articles also generally carry the most weight in relation to the interests of Internet users, this trade-off may in specific cases depend on the nature of the information in question and how sensitive it is to the data subject. person's privacy, as well as the public's interest in having this information, which i.a. may vary depending on the role of this person in public life. "

The Privacy Council has published a guide concerning the right to be forgotten by a search engine, cf. «Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engine cases under the GDPR (part 1) - version adopted after public consultation »Of 7 July 2020. The guide has been published in the wake of Google Spain and Google and GC & Others v CNIL , and replaces the guide previously developed by the Article 29 Working Party . The tribunal assumes that the Privacy Council's guide, like the Article 29 group's guide, has limited value as a source of law, but provides useful guidance as an expression of administrative practice in the audits in the EU and the EEA. For the balancing of interests to be done in this case, the tribunal refers in particular to sections 44 to 52 in the guide from the Privacy Council.

The concrete interest avveiningen
The information contained in the article concerns A's professional practice, and is not related to her private life. It is also not about information that is covered by the special categories of personal data, cf. Article 9 of the Privacy Ordinance, or other information that is subject to special rules, cf. Article 10. There is therefore nothing about the nature of the data itself that indicates that the search match should be deleted.

The actual publication of the news article took place for journalistic purposes. Although the search engines' processing of personal data differs from, and represents something in addition to, the processing of personal data done by the person who publishes a news article on a website, the fact that the original publication took place for journalistic purposes will be a factor that indicates that the search hit should not be deleted. How strongly this consideration applies, however, will depend on a number of different factors. The tribunal will go into more detail on the various matters in the following.

The educational institution was established in 2004 by X County Municipality as an educational institution for upper secondary education in technical and vocational subjects and has received financial support from the public sector. The tribunal assumes that both the employment and dismissal of managers at such an educational institution have a public interest. In Norway, it is also common for the public to take part in public employment, among other things through the scheme with public applicant lists. When A resigned as head of the educational institution in 2012, the educational institution was still owned by the county municipality. A's dismissal was clearly of public interest at this time, and the public's access to information further indicates that articles dealing with this case are also included in the search results when searching for A's name at a much later time. It will nevertheless be the case that this interest weakens as the years go by. In our case, it is over eight years since the article was published.

The tribunal cannot see that it is important for the balancing of interests that is now to be carried out that the educational institution ceased to exist as an independent institution after B acquired the institution when it went bankrupt in 2014.

According to the tribunal, what happens at an educational institution and how the business is managed is also of public interest. The degree of public interest will nevertheless vary with which institution the case concerns; as a starting point, there will be greater public interest in the management of large educational institutions than in the management of a smaller institution to which this case applies. At the educational institution, there were frequent changes of leadership for a period, and A was employed as a leader for a period of only three months. This is information that the public has a legitimate expectation of having access to.

Of particular importance for the tribunal's assessment has been that the newspaper article to which the search meeting leads provides very limited information about the reason why A resigned, in addition to a letter from the employees being sent to the board demanding their resignation. It appears from another article from the online newspaper (published […] 2012) that A's successor was the fourth leader at the educational institution in two years. However, the article about the change of leadership is easily accessible on the website of the online newspaper, which is the local newspaper where the educational institution is located. The article that the search match leads to is also here, and this can be found by searching for the name of the educational institution or A. Anyone who is interested in finding older news articles about the educational institution will therefore easily find these by searching the website of the online newspaper.

The search results' consequences for the registered person are also important. It is expressly stated by the European Court of Justice in Google Spain and Google that the right to be forgotten is not conditional on the relevant personal data having entailed negative consequences ("damages") for the data subject. If there are sufficient grounds for such consequences, there will, however, be a factor that leads in the direction of the data subject being granted the claim for deletion. For the question of what consequences the treatment has actually had, it must be possible to use a more objective assessment based on the facts of the case.

A has pointed out that she has lived with this search for several years, and that she experiences it as a great burden. The tribunal sees no reason to doubt this. She further believes that the search result has a negative effect on her in new recruitment processes. The tribunal does not find it probable that the search on A's name has had such an impact on employment processes that A has been involved in. It will nevertheless appear from her CV that she was head of the educational institution for a very short period in 2012 and the background for this will be something a potential new employer would normally be interested in knowing more about.

The tribunal has been in some doubt in this case, but has after an overall assessment come to the conclusion that A's interest in having the search match deleted outweighs the consideration of freedom of information and the public's interest in having access to the search match by name search. The tribunal cannot see that there are compelling justifiable reasons that take precedence over the data subject's interests, rights and freedoms, and then A's protest must be complied with, cf. Article 21 no.

Following this, A is upheld in its claim for cancellation of the search match and the Data Inspectorate's decision is reversed.

The tribunal finds reason to note that this case was initiated with A's request to the Data Inspectorate on 31 December 2018 for assistance in having the search result deleted by searching for her name in Google. The Data Inspectorate rejected the request in a decision on 5 July 2019. The decision was appealed within the appeal deadline of three weeks. The audit did not find grounds for reversal. The tribunal did not receive the case until 27 August 2020, ie one year and one month after A complained about the Data Inspectorate's decision. Such a long processing time after a decision has been made and the appeal contributes to the right to be forgotten for a long time losing its reality. This is unfortunate in all cases, but especially serious in cases concerning the data subject's exercise of his rights pursuant to Article 21 no. 1. The tribunal will therefore request the Authority to review its case processing routines to ensure that such delays are avoided.

Conclusion
Google is required to delete search results […] when searching for A's name.

The decision is unanimous.

 

 

Oslo, 10 November 2020

Mari Bø Haugstad

Manager